Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe
-
Size
765KB
-
MD5
8afc302a36a124fc15c728998fc71c64
-
SHA1
987d795bc04190030eff5c39ff8ec883e164d71b
-
SHA256
c1cd43409a1e1e93df71f3f6fb92e98c7fb5c4c66539a8a1956201cb5835ec2e
-
SHA512
0dfa680282a71b9a6b33ab4b8c26625faba4913d9a78734ab2297f0837e278b519b2487bd3d10a52974de57a834969adc52dfcb36c61980ffdb00f46fce56e43
-
SSDEEP
12288:ZU5rCOTeiD4gywBTw1uueLs+KxUr3ZF5rn5rLOa54U5w5A:ZUQOJDRyw9wMuetKSr3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
4C1C.tmp4D07.tmp4D84.tmp4E5E.tmp4EEB.tmp4F97.tmp5033.tmp50CF.tmp513D.tmp51E9.tmp52B4.tmp5360.tmp540B.tmp5498.tmp5525.tmp5592.tmp55FF.tmp568C.tmp5728.tmp57B5.tmp5851.tmp58BF.tmp592C.tmp59C8.tmp5A55.tmp5B01.tmp5BBC.tmp5C49.tmp5CC6.tmp5D81.tmp5DEF.tmp5EAA.tmp5F56.tmp6002.tmp6060.tmp60BD.tmp610C.tmp6169.tmp61C7.tmp6234.tmp6292.tmp6300.tmp635D.tmp63AB.tmp63FA.tmp6448.tmp64A5.tmp6503.tmp6561.tmp65BF.tmp660D.tmp666B.tmp66C8.tmp6726.tmp6793.tmp67F1.tmp684F.tmp68AD.tmp692A.tmp6987.tmp69F5.tmp6A62.tmp6AD0.tmp6B3D.tmppid process 2756 4C1C.tmp 5048 4D07.tmp 4584 4D84.tmp 2088 4E5E.tmp 2468 4EEB.tmp 1640 4F97.tmp 4956 5033.tmp 2488 50CF.tmp 2108 513D.tmp 3812 51E9.tmp 3040 52B4.tmp 5076 5360.tmp 1272 540B.tmp 796 5498.tmp 4172 5525.tmp 3100 5592.tmp 4720 55FF.tmp 4112 568C.tmp 212 5728.tmp 436 57B5.tmp 2304 5851.tmp 4984 58BF.tmp 224 592C.tmp 3584 59C8.tmp 4780 5A55.tmp 3528 5B01.tmp 628 5BBC.tmp 4156 5C49.tmp 2696 5CC6.tmp 4144 5D81.tmp 1696 5DEF.tmp 4512 5EAA.tmp 1488 5F56.tmp 4796 6002.tmp 2000 6060.tmp 3128 60BD.tmp 3368 610C.tmp 3068 6169.tmp 3920 61C7.tmp 4876 6234.tmp 3268 6292.tmp 4804 6300.tmp 1276 635D.tmp 4560 63AB.tmp 2908 63FA.tmp 4900 6448.tmp 1848 64A5.tmp 3848 6503.tmp 3648 6561.tmp 4352 65BF.tmp 1272 660D.tmp 1492 666B.tmp 512 66C8.tmp 2600 6726.tmp 3100 6793.tmp 4720 67F1.tmp 4764 684F.tmp 3876 68AD.tmp 3940 692A.tmp 1088 6987.tmp 2312 69F5.tmp 5080 6A62.tmp 1104 6AD0.tmp 3888 6B3D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe4C1C.tmp4D07.tmp4D84.tmp4E5E.tmp4EEB.tmp4F97.tmp5033.tmp50CF.tmp513D.tmp51E9.tmp52B4.tmp5360.tmp540B.tmp5498.tmp5525.tmp5592.tmp55FF.tmp568C.tmp5728.tmp57B5.tmp5851.tmpdescription pid process target process PID 2000 wrote to memory of 2756 2000 2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe 4C1C.tmp PID 2000 wrote to memory of 2756 2000 2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe 4C1C.tmp PID 2000 wrote to memory of 2756 2000 2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe 4C1C.tmp PID 2756 wrote to memory of 5048 2756 4C1C.tmp 4D07.tmp PID 2756 wrote to memory of 5048 2756 4C1C.tmp 4D07.tmp PID 2756 wrote to memory of 5048 2756 4C1C.tmp 4D07.tmp PID 5048 wrote to memory of 4584 5048 4D07.tmp 4D84.tmp PID 5048 wrote to memory of 4584 5048 4D07.tmp 4D84.tmp PID 5048 wrote to memory of 4584 5048 4D07.tmp 4D84.tmp PID 4584 wrote to memory of 2088 4584 4D84.tmp 4E5E.tmp PID 4584 wrote to memory of 2088 4584 4D84.tmp 4E5E.tmp PID 4584 wrote to memory of 2088 4584 4D84.tmp 4E5E.tmp PID 2088 wrote to memory of 2468 2088 4E5E.tmp 4EEB.tmp PID 2088 wrote to memory of 2468 2088 4E5E.tmp 4EEB.tmp PID 2088 wrote to memory of 2468 2088 4E5E.tmp 4EEB.tmp PID 2468 wrote to memory of 1640 2468 4EEB.tmp 4F97.tmp PID 2468 wrote to memory of 1640 2468 4EEB.tmp 4F97.tmp PID 2468 wrote to memory of 1640 2468 4EEB.tmp 4F97.tmp PID 1640 wrote to memory of 4956 1640 4F97.tmp 5033.tmp PID 1640 wrote to memory of 4956 1640 4F97.tmp 5033.tmp PID 1640 wrote to memory of 4956 1640 4F97.tmp 5033.tmp PID 4956 wrote to memory of 2488 4956 5033.tmp 50CF.tmp PID 4956 wrote to memory of 2488 4956 5033.tmp 50CF.tmp PID 4956 wrote to memory of 2488 4956 5033.tmp 50CF.tmp PID 2488 wrote to memory of 2108 2488 50CF.tmp 513D.tmp PID 2488 wrote to memory of 2108 2488 50CF.tmp 513D.tmp PID 2488 wrote to memory of 2108 2488 50CF.tmp 513D.tmp PID 2108 wrote to memory of 3812 2108 513D.tmp 51E9.tmp PID 2108 wrote to memory of 3812 2108 513D.tmp 51E9.tmp PID 2108 wrote to memory of 3812 2108 513D.tmp 51E9.tmp PID 3812 wrote to memory of 3040 3812 51E9.tmp 52B4.tmp PID 3812 wrote to memory of 3040 3812 51E9.tmp 52B4.tmp PID 3812 wrote to memory of 3040 3812 51E9.tmp 52B4.tmp PID 3040 wrote to memory of 5076 3040 52B4.tmp 5360.tmp PID 3040 wrote to memory of 5076 3040 52B4.tmp 5360.tmp PID 3040 wrote to memory of 5076 3040 52B4.tmp 5360.tmp PID 5076 wrote to memory of 1272 5076 5360.tmp 540B.tmp PID 5076 wrote to memory of 1272 5076 5360.tmp 540B.tmp PID 5076 wrote to memory of 1272 5076 5360.tmp 540B.tmp PID 1272 wrote to memory of 796 1272 540B.tmp 5498.tmp PID 1272 wrote to memory of 796 1272 540B.tmp 5498.tmp PID 1272 wrote to memory of 796 1272 540B.tmp 5498.tmp PID 796 wrote to memory of 4172 796 5498.tmp 5525.tmp PID 796 wrote to memory of 4172 796 5498.tmp 5525.tmp PID 796 wrote to memory of 4172 796 5498.tmp 5525.tmp PID 4172 wrote to memory of 3100 4172 5525.tmp 5592.tmp PID 4172 wrote to memory of 3100 4172 5525.tmp 5592.tmp PID 4172 wrote to memory of 3100 4172 5525.tmp 5592.tmp PID 3100 wrote to memory of 4720 3100 5592.tmp 55FF.tmp PID 3100 wrote to memory of 4720 3100 5592.tmp 55FF.tmp PID 3100 wrote to memory of 4720 3100 5592.tmp 55FF.tmp PID 4720 wrote to memory of 4112 4720 55FF.tmp 568C.tmp PID 4720 wrote to memory of 4112 4720 55FF.tmp 568C.tmp PID 4720 wrote to memory of 4112 4720 55FF.tmp 568C.tmp PID 4112 wrote to memory of 212 4112 568C.tmp 5728.tmp PID 4112 wrote to memory of 212 4112 568C.tmp 5728.tmp PID 4112 wrote to memory of 212 4112 568C.tmp 5728.tmp PID 212 wrote to memory of 436 212 5728.tmp 57B5.tmp PID 212 wrote to memory of 436 212 5728.tmp 57B5.tmp PID 212 wrote to memory of 436 212 5728.tmp 57B5.tmp PID 436 wrote to memory of 2304 436 57B5.tmp 5851.tmp PID 436 wrote to memory of 2304 436 57B5.tmp 5851.tmp PID 436 wrote to memory of 2304 436 57B5.tmp 5851.tmp PID 2304 wrote to memory of 4984 2304 5851.tmp 58BF.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_8afc302a36a124fc15c728998fc71c64_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"23⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"24⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"25⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"26⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"27⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"28⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"29⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"30⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"31⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"32⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"33⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"34⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"35⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"36⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"37⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"38⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"39⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"40⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"41⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"42⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"43⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"44⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"45⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"46⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"47⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"48⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"49⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"50⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"51⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"52⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"53⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"54⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"55⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"56⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"57⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"58⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"59⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"60⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"61⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"62⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"63⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"64⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"65⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"66⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"67⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"68⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"69⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"70⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"71⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"72⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"73⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"74⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"75⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"76⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"77⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"78⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"79⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"80⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"81⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"82⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"83⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"84⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"85⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"86⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"87⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"88⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"89⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"90⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"91⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"92⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"93⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"94⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"95⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"96⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"97⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"98⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"99⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"100⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"101⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"102⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"103⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"104⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"105⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"106⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"107⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"108⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"109⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"110⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"111⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"112⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"113⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"114⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"115⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"116⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"117⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"118⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"119⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"120⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"121⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"122⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-